Logical Partition Media Access Control Impostor Detector

ABSTRACT

Provided are techniques for to enable a virtual input/output server (VIOS) to establish cryptographically secure signals with target LPARs to detect an imposter or spoofing LPAR. The secure signal, or “heartbeat,” may be configured as an Internet Key Exchange/Internet Protocol Security (IKE/IPSec) encapsulated packet (ESP) connection or tunnel. Within the tunnel, the VIOS pings each target LPAR and, if a heartbeat is interrupted, the VIOS makes a determination as to whether the tunnel is broken, the corresponding LPAR is down or a media access control (MAC) spoofing attach is occurring. The determination is made by sending a heartbeat that is designed to fail unless the heartbeat is received by a spoofing device.

CROSS-REFERENCES TO RELATED APPLICATIONS

The present application is a continuation and claims the benefit of thefiling date of an application entitled, “Logical Partition Media AccessControl Impostor Detector” Ser. No. 12/647,345, filed Dec. 24, 2009,assigned to the assignee of the present application, and hereinincorporated by reference.

BACKGROUND

As processing demands have increased, computing systems have become bothmore complicated and interconnected. For example, a particular computingdevice may be partitioned into logical partitions, or “LPARs,” each ofwhich includes a subset of the computing device's resources virtualizedas a separate computer. Also, computing systems have become increasinglyinterconnected via various types of networks such as local area networks(LANs) and the Internet. This complexity and interconnectivity hascreated a number of issues related to computer security.

Provided is are methods, apparatus and method of manufacturer formonitoring a number of computing devices for security attacks. Thedisclosed techniques include, among other things, establishing aplurality of cryptographically secure channels, each channel between amonitoring device and a monitored device of a plurality of monitoreddevices, each monitored device of the plurality of monitored devicesassociated with unique address; transmitting a heartbeat from themonitoring device to a first monitored device of the plurality ofmonitored devices via a first secure channel, corresponding to the firstmonitored device, of the plurality of secure channels; if a response tothe heartbeat is received, transmitting a second heartbeat from themonitoring device to a second monitored device of the plurality ofmonitor devices via the first secure channel; and if a response to theheartbeat is not received, executing a spoofing detection scheme,comprising: transmitting a second heartbeat to the first monitoreddevice via an address associated with a second monitored device;receiving a response to the second heartbeat; and determining that aspoofing attack has occurred by the fact that the response to the secondheartbeat has been received.

This summary is not intended as a comprehensive description of theclaimed subject matter but, rather, is intended to provide a briefoverview of some of the functionality associated therewith. Othersystems, methods, functionality, features and advantages of the claimedsubject matter will be or will become apparent to one with skill in theart upon examination of the following figures and detailed description.

BRIEF DESCRIPTION OF THE DRAWINGS

A better understanding of the claimed subject matter can be obtainedwhen the following detailed description of the disclosed embodiments isconsidered in conjunction with the following figures, in which:

FIG. 1 is a block diagram of one example of a computing architecturethat may implement the claimed subject matter.

FIG. 2 is a block diagram of a Heartbeat Generation and Monitoringsystem (HBGM) that may be employed to implement the claimed subjectmatter.

FIG. 3 is a flowchart of a Setup HBGM process corresponding to the HBGMof FIG. 2.

FIG. 4 is a flowchart of an Operate HBGM process corresponding to theHBGM of FIG. 2.

FIG. 5 is a flowchart of one example of exception processing associatedwith the Operate HBGM process of FIG. 4.

FIG. 6 is a flowchart of a second example of exception processingassociated with Operate HBGM process of FIG. 4.

DETAILED DESCRIPTION

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system or computer program product.Accordingly, aspects of the present invention may take the form of anentirely hardware embodiment, an entirely software embodiment (includingfirmware, resident software, micro-code, etc.) or an embodimentcombining software and hardware aspects that may all generally bereferred to herein as a “circuit,” “module” or “system.” Furthermore,aspects of the present invention may take the form of a computer programproduct embodied in one or more computer readable medium(s) havingcomputer readable program code embodied thereon.

One embodiment, in accordance with the claimed subject, is directed to aprogrammed method for detecting attacks on a system employing logicalpartitions. The term “programmed method”, as used herein, is defined tomean one or more process steps that are presently performed; or,alternatively, one or more process steps that are enabled to beperformed at a future point in time. The term “programmed method”anticipates three alternative forms. First, a programmed methodcomprises presently performed process steps. Second, a programmed methodcomprises a computer-readable medium embodying computer instructions,which when executed by a computer performs one or more process steps.Finally, a programmed method comprises a computer system that has beenprogrammed by software, hardware, firmware, or any combination thereof,to perform one or more process steps. It is to be understood that theterm “programmed method” is not to be construed as simultaneously havingmore than one alternative form, but rather is to be construed in thetruest sense of an alternative form wherein, at any given point in time,only one of the plurality of alternative forms is present.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a computer readable storage medium. A computer readablestorage medium may be, for example, but not limited to, an electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system,apparatus, or device, or any suitable combination of the foregoing. Morespecific examples (a non-exhaustive list) of the computer readablestorage medium would include the following: an electrical connectionhaving one or more wires, a portable computer diskette, a hard disk, arandom access memory (RAM), a read-only memory (ROM), an erasableprogrammable read-only memory (EPROM or Flash memory), an optical fiber,a portable compact disc read-only memory (CD-ROM), an optical storagedevice, a magnetic storage device, or any suitable combination of theforegoing. In the context of this document, a computer readable storagemedium may be any tangible medium that can contain, or store a programfor use by or in connection with an instruction execution system,apparatus, or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Aspects of the present invention are described below with reference toflowchart illustrations and/or block diagrams of apparatus (systems) andcomputer program products according to embodiments of the invention. Itwill be understood that each block of the flowchart illustrations and/orblock diagrams, and combinations of blocks in the flowchartillustrations and/or block diagrams, can be implemented by computerprogram instructions. These computer program instructions may beprovided to a processor of a general purpose computer, special purposecomputer, or other programmable data processing apparatus to produce amachine, such that the instructions, which execute via the processor ofthe computer or other programmable data processing apparatus, createmeans for implementing the functions/acts specified in the flowchartand/or block diagram block or blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article of manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other devices to causea series of operational steps to be performed on the computer, otherprogrammable apparatus or other devices to produce a computerimplemented process such that the instructions which execute on thecomputer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

Provided are techniques for to enable a virtual input/output server(VIOS) to establish cryptographically secure signals with target LPARsto detect an imposter or spooling LPAR. The secure signal, or“heartbeat,” may be configured as an Internet Key Exchange/InternetProtocol Security (IKE/IPSec) encapsulated packet (ESP) connection ortunnel. Within the tunnel, the VIOS pings each target LPAR and, if aheartbeat is interrupted, the VIOS makes a determination as to whetherthe tunnel is broken, the corresponding LPAR is down or a media accesscontrol (MAC) spoofing attach is occurring.

Turning now to the figures, FIG. 1 is a block diagram of one example ofa computing architecture 100 that may implement the claimed subjectmatter. Computing architecture 100 includes a computing device 102,which would typically include a processor, memory, data busses, none ofwhich are shown, but which should be familiar to those with skill in thecomputing arts. Processing space associated with computing system 102 isorganized into logical partitions (LPARs), which for the purposes ofthis example include an LPAR 130 and an LPAR 140. As explained above inthe Summary, an LPAR is a subset of a computer's resources, virtualizedas a separate computing system. A virtual input/output server (VIOS)120, in conjunction with a hypervisor 100, enables LPARs 130 and 140 towork in a coordinated manner.

Hypervisor 110 is accessed via a hypervisor management consol (HMC) 104that is accessible via a network 150. HMC 104 is coupled to a switch106, which is coupled to hypervisor 100 via a flexible service processor(FSP) 108. Although not illustrated, HMC 104 would typically include atleast a monitor, a keyboard and a pointing device, or “mouse,” to enablehuman interaction. HMC 104 also typically includes a memory and aprocessor. Hypervisor 110 is communicatively coupled to other componentsof computing system 102, such as VIOS 120 and LPARs 130 and 140 via anumber of virtual local area networks (VLANs) 112, 114 and 116.Specifically, in this example, VLAN 112 is coupled to a virtual Ethernet(VEN) 123, associated with VIOS 120, and a VEN 132, associated with LPAR130. VLAN 114 is coupled to a VEN 133, associated with LPAR 130, and aVEN 142, associated with LPAR 140. VLAN 116 is coupled to a VEN 122,associated with VIOS 120, and a VEN 143, associated with LPAR 140.

VENs 122 and 123 of VIOS 120 are also coupled to a bridge 126 thatprovides a connection to a real Ethernet (REN) 124. LPAR 140 alsoincludes a REN 144, which is coupled to a network 152. It should beunderstood that VLANs 112, 114 and 116, VENs 122, 123, 132, 133, 142 and143, RENs 124 and 144 and bridge 126 are used merely as examplesthroughout the Specification of components of an architecture 100 and acomputing system 102 that may implement the claimed subject matter. Inother words, as should be appreciated by one with skill in the computingand communication arts, architecture 100, computing system 102 andcomponents 112, 114, 116, 122, 123, 124, 126, 132, 133, 142 and 143 and144 provide a large degree of flexibility for the various components tocommunicate with each other and, via networks 150 and 152, with usersand other computing devices.

VIOS 120 also includes a Heartbeat Generation and Monitor (HBGM)component 128. HBGM 128 provides memory and logic for one implementationof the claimed subject matter. HBGM 128 is explained in more detailbelow in conjunction with FIGS. 2-6.

FIG. 2 is a block diagram of HBGM 128, first introduced above inconjunction with FIG. 1, which may be employed to implement the claimedsubject matter. HBGM 128 includes an input/output (I/O) module 162, adata module 164, a Heartbeat (FIB) generation module 166, a HB analysismodule 168, a cryptography (crypto) module 170 and a graphical userinterface (GUI) module 172. For the sake of the following examples, HBGM128 is assumed to execute on a processor associated with computingsystem 102 (FIG. 1) and stored in a data storage (not shown) associatedwith computing system 102. It should be understood that the claimedsubject matter can be implemented in many types of computing systems anddata storage structures but, for the sake of simplicity, is describedonly in terms of computer 102 and system architecture 100 (FIG. 1).Further, the representation of HBGM 128 in FIG. 2 is a logical model. Inother words, components 162, 164, 166, 168, 170 and 172 may be stored inthe same or separates files and loaded and/or executed within system 100either as a single system or as separate processes interacting via anyavailable inter process communication (IPC) techniques.

I/O module 162 handles any communication between HBGM 128 and othercomponents of computing system 102, including the transmission ofheartbeats generated by HB generation module 166. Data module 164 is adata repository for information, including parameters, settings andlists, which HBGM 128 requires during normal operation. Examples of thetypes of information stored in data module 164 include HBGMconfiguration data 182, system configuration data 184, a secure list ofdata keys 186 and a data cache 188. HBGM configuration data 182 storesparameters that may be set by a user or system administrator to controlthe operation of HBGM 128 (see 204, FIG. 3). Examples include, but arenot limited to, a parameter that determines a number of ignoredheartbeats before an action is taken (see FIGS. 4 and 5) and informationconcerning authorized users. System configuration data 184 storesinformation concerning computing system 102, including the variouscomponents, which HBGM 128 utilizes during operation (see 206, FIG. 3).Data keys 186 is a cryptographically secure area for storing sessionkeys to enable secure communication between HBGM 128 and othercomponents of computing system 102, including LPARs 130 and 140. Datacache 188 stores any interim results of processing executed by HBGM 128.

HB generation module 166 executes logic for the generation of heartbeatstransmitted from HBGM 128 and VIOS 120 (FIG. 1) and LPARs 130 and 140(see 234, FIG. 4). FIB analysis module 168 analyses responses toheartbeats generated by module 166, including initiating action inresponse to an anomalous or missing heartbeat (see 238 and 240, FIG. 4).Cryptography (crypto) module 170 encrypts and decrypts communicationsbetween HBGM 128 and the other components of computing system 102 byemploying session keys stored in data keys 186. GUI component 172enables administrator and other users of HBGM 128 to interact with andto define the desired functionality of HBGM 128. In the alternative, aGUI for interaction with HBGM 128 may be incorporated into HMC 104 (FIG.1). Components 162, 164,166, 168, 170, 172, 182, 184, 186 and 188 aredescribed in more detail below in conjunction with FIGS. 3-5.

FIG. 3 is a flowchart of a Setup HBGM process 200 corresponding to HBGM128 or FIGS. 1 and 2. In this example, logic associated with process 200is stored and executed on computing system 102 (FIG. 1) as part of HBGM128 (FIGS. 1 and 2). Process 200 starts in a “Begin Setup HeartbeatGeneration and Monitor System (HBGM)” block 202 and proceeds immediatelyto a “Retrieve HBGM Data” block 204. During block 204, process 200retrieves configuration data (see 182, FIG. 2) that controls theoperation of HBGM 128 (see 230, FIG. 4). As described above inconjunction with FIG. 2, examples of configuration data include, but arenot limited to, a parameter that determines a number of ignoredheartbeats before an action is taken (see FIGS. 4 and 5) and informationconcerning authorized users.

During a “Retrieve System Data” block 206, process 200 retrievesinformation relating to the system on which HBGM 128 is installed andexpected to monitor (see 184, FIG. 2), including information that enableHBGM 128 to establish a communication channel with each monitoreddevice. This information typically includes cryptographic information(see 186, FIG. 2) to secure the established channels.

During an “Establish Connections” block 208, HBGM 128 establishes asecure communication channel with each monitored device such as LPAR 130and 140 (FIG. 1) by employing the information retrieved during blocks204 and 206. One example of a suitable secure connection, employed fordescriptive purposes during the remainder of the Specification, is anInternet Key Exchange/Internet Protocol Security (IKE/IPSec)encapsulated packet (ESP) connection/tunnel although one with skill inthe computing or communication arts should know of other suitabletechnologies. Each monitored LPAR 130 and 140 may share the same IKE keybecause the IKE protocol establishes a unique session key for eachconnection. A unique pre-shared key may also be used between each LPAR130 and 140 and VIOS 120 (FIG. 1). In one embodiment, the initialhandshake employs Diffie-Helman to protect the communication.

During a “Setup Issues?” block 210, process 200 determines whether ornot the channel establishment activities of block 208 have completedsuccessfully. One of many possible examples of a communication issuethat may arise is an inability to create a secure connection with aparticular device. If a setup issue is detected, process 200 proceeds toa “Resolve Issues” block 212 during which the issue is addressed, bymeans of programmatic actions, by notification of a system administratorwho takes action or by some combination of the two.

One all setup issues have been resolved during block 212 or, if duringblock 210, process 200 determines that no issues have been detected,control proceeds to a “Spawn Operating Process” block 214 during whichan operation process (see 230, FIG. 4) is executed. Once the operationprocess is launched, a notice of this information is transmitted to HMC.104 (FIG. 1) and a system administrator, a log file or both during a“Notify HMC” block 216. Finally, process 200 proceeds to an “End SetupHBGM ” block 219 in which process 200 is complete.

FIG. 4 is a flowchart of an Operate HBGM process 230 corresponding toHBGM 128 of FIGS. 1 and 2. Like process 200 (FIG. 3), logic associatedwith process 230 is stored and executed on computing system 102 (FIG. 1)as part of HBGM 128 (FIGS. 1 and 2). Process 230 starts in a “BeginOperate HBGM” block 232 and proceeds immediately to a “Poll LPAR” block234. During block 234, process 230 polls a LPAR such as LPAR 130 or 140(FIG. 1) by transmitting a signal, or “heartbeat,” through, in thisexample, the IKE/IPsec ESP tunnel established for the particular LPAR(see 208, FIG. 3). During a “Wait for Response” block 236, process 230waits for a response from the signal transmitted during block 234.Typically, there are three (3) possible outcomes from the transmissionof a heartbeat: 1) a timeout, 2) a correct response that indicates thecorrect LPAR has responded; or 3) a response that is suspicious.

During a “Timeout?” block 238, process 230 determines whether or not asufficient time has passed with no response to the heartbeat transmittedduring block 234. If one LPAR such as LPAR 130 or 140 is interceptingtransmissions for the other, typically neither LPAR will respond to aheartbeat. If process 230 determines that a timeout has occurred,control proceeds to a Transition Point “A,” which is explained in moredetail below in conjunction with FIG. 5. If no timeout is detected,control proceeds to a “Correct Response?” block 240 during which process230 determines whether or not a received heartbeat is appropriate forthe particular LPAR 130 or 140 to which the heartbeat was intended. Ifspoofing is taking place, e.g. LPAR 130 is intercepting communicationintended for LPAR 140, LPAR 130 is not able to respond appropriately tothe heartbeat because the spoofing LPAR 130 does not have the necessaryunique session key of the spoofed LPAR 140.

If process 230 detects an incorrect or inappropriate response to theheartbeat transmitted during block 234, control proceeds to a TransitionPoint “B,” which is described in more detail below in conjunction withFIG. 6. If process 230 determines during block 240 that a correctheartbeat has been received or, following processing associated withTransition Points A and B via a Transition. Point C is completed,process 230 proceeds to a “Reset Count” block 242 during which process230 resets a count (see FIG. 5) associated with the LPAR to which theheartbeat was transmitted. During a “Go to Next LPAR” block 244, process230 selects another LPAR, returns to block 134 and processing continuesas described above. Selection of a next LPAR may be based upon a roundrobin scheme or another scheme. For example, selection may be dependentupon a priority scheme or based upon detection of a possible issue witha particular LPAR.

Finally, process 230 is halted by means of an asynchronous interrupt248, which passes control to an “End Operate HBGM” block 249 in whichprocess 230 is complete. Interrupt 248 is typically generated when theOS, VIOS or HBGM of which processes 230 is a part is itself halted,either explicitly by a system administrator or because of a power downsituation. During nominal operation, process 230 continuously loopsthrough the blocks 234, 236, 238, 240, 242 and 244, transmittingheartbeats to each protected device.

FIG. 5 is a flowchart of one example of exception processing code 250associated with Operate HBGM process 230 of FIG. 4. Processing code 250starts in Transition Point A (FIG. 4) and proceeds immediately to an“Increment Count” block 262. During block 262, process code 250,increments a count parameter associated with the LPAR to which theheartbeat was transmitted. During a “Count>Threshold?” block 264,process code 250 determines whether or not the count has exceeded apreset parameter (see 182, FIG. 2). The value of the parameter may beset to ‘1’ indicating that action needs to be taken upon the detectionof a single missing heartbeat or to some greater value depending uponthe desired sensitivity of the system. If the count exceeds theallowable count, control proceeds to Transition Point B (FIG. 4), whichis described in more detail below in conjunction with FIG. 6. If thecount does not exceed the threshold, control proceeds to TransitionPoint C (FIG. 4) and control returns to process 230 (FIG. 4).

FIG. 6 is a flowchart of a second example of exception processing code260 associated with Operate HBGM process 230 of FIG. 4. Processing code260 starts in Transition Point B (FIG. 4) and proceeds immediately to a“Notify Hypervisor Management Consol (HMC)” block 262. During block 262,process code 260 transmits a notice to HMC 104 (FIG. 1) with anindication that an anomalous event has occurred. At this point a systemadministrator may decide to investigate. An automatic response beginsexecution during a “Prepare IPsec/ESP Heartbeat (HB)” block 264. Duringblock 264, VIOS 120 (FIG. 1) prepares an IPsec/ESP heartbeat for thetarget system. However, the media access control (MAC) address is set tothe MAC address of the device that is suspected of spoofing. Since theMAC address is not part of the IPsec/ESP packet, the spoofing devicewill be able to respond to the heartbeat but the original target willnot. In other words, the transmitted heartbeat is designed to failunless the heartbeat is received by a spoofing device. Of course, aspoofing device will not be able to make this determination and willtherefore respond to the heartbeat and thus reveal the attack.

During a “Receive Confirmation?” block 266, process code 260 determineswhether or not a confirmation heartbeat has been received. If so,control proceeds to a “Notify of Spoofing” block 268 during which HMC104 is notified by HBGM 128 (FIGS. 1 and 2) that the spoofing attack ofwhich HMC 104 was warned during block 262 has been established asoccurring. If not, during a “Notify of Non-Spoofing” block 270, HMC 104is notified that the warning transmitted during block 262 has beenresolved. Finally, process code 260 proceeds to Transition Point C (FIG.4) and control returns to process 230.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the singular forms “a”, “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising,” when used in this specification, specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components, and/or groups thereof.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below are intended toinclude any structure, material, or act for performing the function incombination with other claimed elements as specifically claimed. Thedescription of the present invention has been presented for purposes ofillustration and description, but is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the artwithout departing from the scope and spirit of the invention. Theembodiment was chosen and described in order to best explain theprinciples of the invention and the practical application, and to enableothers of ordinary skill in the art to understand the invention forvarious embodiments with various modifications as are suited to theparticular use contemplated.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified logical function(s). It should also be notedthat, in some alternative implementations, the functions noted in theblock may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

1. A computing system, comprising: a processor; a computer-readablestorage medium, coupled to the processor; and logic, stored on thecomputer-readable storage medium and executed on the processor, for:establishing a plurality of cryptographically secure channels, eachchannel between a monitoring device and a monitored device of aplurality of monitored devices, each monitored device associated withunique address; transmitting a heartbeat from the monitoring device to afirst monitored device of the plurality of monitored devices via a firstsecure channel, corresponding to the first monitored device, of theplurality of secure channels; if a response to the heartbeat isreceived, transmitting a second heartbeat from the monitoring device toa second monitored device of the plurality of monitored devices via thefirst secure channel; and if a response to the heartbeat is notreceived, executing a spoofing detection scheme, comprising:transmitting a second heartbeat to the first monitored device via anaddress associated with a second monitored device; receiving a responseto the second heartbeat; and determining that a spoofing attack hasoccurred by the fact that the response to the second heartbeat has beenreceived.
 2. The system of claim 1, wherein the monitored devices arelogical partitions (LPARs) of a computing device.
 3. The system of claim1, wherein the monitoring device is a virtual input/output server (VIOS)of the computing device.
 4. The system of claim 1, the logic furthercomprising logic for determining that the first secure channel is brokenby the fact that the response to the second heartbeat is not received.5. The system of claim 1, wherein the cryptographically secure channelsare based on an Internet Key Exchange/Internet Protocol Security(IKE/IPSec) encapsulated packet (ESP) protocol.
 6. A computingprogramming product, comprising: a computer-readable storage medium; andlogic, stored on the computer-readable storage medium for execution on aprocessor, for: establishing a plurality of cryptographically securechannels, each channel between a monitoring device and a monitoreddevice of a plurality of monitored devices, each monitored deviceassociated with unique address; transmitting a heartbeat from themonitoring device to a first monitored device of the plurality ofmonitor devices via a first secure channel, corresponding to the firstmonitored device, of the plurality of secure channels; if a response tothe heartbeat is received, transmitting a second heartbeat from themonitoring device to a second monitored device of the plurality ofmonitored. devices via the first secure channel; and if a response tothe heartbeat is not received, executing a spoofing detection scheme,comprising: transmitting a second heartbeat to the first monitoreddevice via an address associated with a second monitored device;receiving a response to the second heartbeat; and determining that aspooling attack has occurred by the fact that the response to the secondheartbeat has been received.
 7. The computing programming product ofclaim 6, wherein the monitored devices are logical partitions (LPARs) ofa computing device.
 8. The computing programming product of claim 6,wherein the monitoring device is a virtual input/output server (VIOS) ofthe computing device.
 9. The computing programming product of claim 6,the logic further comprising logic for determining that the first securechannel is broken by the fact that the response to the second heartbeatis not received.
 10. The computing programming product of claim 6,wherein the cryptographically secure channels are based on an InternetKey Exchange/Internet Protocol Security (IKE/IPSec) encapsulated packet(ESP) protocol.